Granular RBAC for metrics

[grampelberg]

Description

Introduce view isolation for metrics, defined by Kubernetes RBAC, to provide multi-tenancy to security conscious organizations. We previously have done this using an APIService for tap functionality.

The smi-metrics project already implements Linkerd metrics as an APIService. This has the added value of dogfooding smi-metrics and providing common tooling for other integrations in the future.

Details

• Proposal
• Engineering Notes
• Project

[alenkacz]

@grampelberg @admc could you please assign this to me? Thanks :)

[grampelberg]

Note: it is probably worth using smi-metrics where it can be used and expanding the spec where it isn't usable instead of creating a new one-off APIService.

[PierrePIRONIN]

Hi ! I’m exactly in this use-case, do you currently work on it ? Thanks

[grampelberg]

@PierrePIRONIN I believe that @alenkacz is currently looking into it. You can use smi-metrics as is to do something similar though.

[grampelberg]

Historical

---

What problem are you trying to solve?

Many organizations have teams sharing the same cluster which should not see each other's data (multi-tenant). This was addressed for tap as part of #2725. Now that it is possible to have granular, Kubernetes based RBAC policies for tap, statistics should provide a similar benefit.

How should the problem be solved?

• Add smi-metrics-adapter to the install.
• Move the CLI commands that rely on stats to use the adapter.
• Move the dashboard's underlying stat implementation over to use the adapter.

Out of scope

• Moving grafana over to the adapter.